Overview

overview

10

Static

static

efcbeee181...82.exe

windows7_x64

10

efcbeee181...82.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182

  • Size

    246KB

  • Sample

    220508-hartbscder

  • MD5

    2dade2e0c6d4d29ae58f4d62cbbeeee8

  • SHA1

    87432db4e77f0dce442e1cbe00faf86b8ace3f35

  • SHA256

    efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182

  • SHA512

    2d01a4dd3be434ddb3d19af314eaf708325c7ffcd4cce9a4f33ac8932a65292e59d41dc9cbd3ea6a377d9e3f3713574cb0ebc7d601df337bd520ce1e8c3d5cb2

Score
10/10
matiexcollectionkeyloggerspywarestealer

Malware Config

Extracted

Family

matiex

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ze5qw@iC?1E}

Targets

    • Target

      efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182

    • Size

      246KB

    • MD5

      2dade2e0c6d4d29ae58f4d62cbbeeee8

    • SHA1

      87432db4e77f0dce442e1cbe00faf86b8ace3f35

    • SHA256

      efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182

    • SHA512

      2d01a4dd3be434ddb3d19af314eaf708325c7ffcd4cce9a4f33ac8932a65292e59d41dc9cbd3ea6a377d9e3f3713574cb0ebc7d601df337bd520ce1e8c3d5cb2

    Score
    10/10
    matiexcollectionkeyloggerspywarestealer

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks